Walk through an email outage with your team to identify essential work, trusted contacts, payment controls and recovery questions for your technology provider.
Use a discussion scenario, not a live disruption
Choose a normal workday and imagine that staff cannot use business email. Do not disable a real account or test against a vendor without authorization. Invite the people who handle operations, customer communication, payments and technology. Give the discussion a defined end time. The goal is to discover dependencies and unclear decisions before an incident, not to assess individual employees or declare the organization secure.
Identify the work that stops first
List the tasks due that day: appointments, dispatch, customer orders, supplier instructions or payroll approval. For each, ask which system and contact information are needed. A Chesterfield service company or a downtown Richmond office may lose more than messaging if the same sign-in controls access to files, calendars and other tools. Record those dependencies explicitly. Identify a business owner for each critical activity and the longest interruption that owner believes needs planning.
Find trusted contact and payment routes
Ask how the team would reach its technology provider and decision makers without relying on the unavailable mailbox. Keep the approved contact plan accessible through a separate, controlled route. Discuss how a changed bank instruction would be verified using an established contact method. Do not improvise a new approval chain simply because a message looks urgent. Record who can authorize communications and payments when a usual approver is unavailable.
Ask for evidence of recovery
Have the provider explain which data and configurations are backed up, how access is controlled and what a restoration demonstration would show. CISA’s guidance for managed providers and smaller organizations addresses backups, multifactor authentication and limiting administrative access. Use that guidance to frame questions, while asking the provider to identify controls and obligations relevant to your actual systems. A backup completion message alone does not demonstrate that a critical workflow can be restored.
Finish with a short improvement list
Write down the gaps found, the person responsible and the next review date. Useful actions might include correcting a contact list, documenting account ownership or scheduling an authorized restoration test. Keep sensitive system details in the business’s protected records rather than in a public form. Run the discussion again after a major provider or system change. This is a general continuity exercise, not a claim of incident response readiness, compliance certification or protection against every attack.